Replying to myself: my current theory is that the Dutch regime weighed the risk of political potential blowback from the U.S. (specifically executive office), and did not consider it worthwhile protecting the final servers of a group that is winding down anyways.

Again, would love to hear a domain expert weigh in! Also because I walk past this data center every day :)